I've downloaded tar.gz and see that rebar gets deps from master at building. Because of this, depending on the day when I compile this release, I may get different result (someone pushed to processone/xml master, for instance). Why don't you pack all necessary sources into tar.gz? Or, stick rebar deps onto known commits for that particular ejabberd release.